Jonathan Hui
edd387d04e
This commit improves the robustness of CoAP option parsing by adding rigorous validation checks to prevent potential overflows and null pointer dereferences. Summary of changes: 1. In 'ReadExtendedOptionField()', added an overflow check when calculating extended lengths for 2-byte extensions. It now returns 'kErrorParse' if the value would exceed the 16-bit range. 2. In 'ReadBlockOptionValues()', added a check to ensure the block option exists before accessing it. This prevents a crash when 'GetOption()' returns null. 3. In 'ReadBlockOptionValues()', added length validation to ensure the option value does not exceed the local buffer size (5 bytes) before copying. 4. Added a new unit test 'test_coap_overflow' to verify these validation checks and ensure they correctly handle malformed or missing options.
What is OpenThread?
OpenThread released by Google is... 
...an open-source implementation of the Thread networking protocol. Google Nest has released OpenThread to make the technology used in Nest products more broadly available to developers to accelerate the development of products for the connected home.
...OS and platform agnostic, with a narrow platform abstraction layer and a small memory footprint, making it highly portable. It supports both system-on-chip (SoC) and network co-processor (NCP) designs.
...a Thread Certified Component, implementing all features defined in the Thread 1.4.0 specification, including all Thread networking layers (IPv6, 6LoWPAN, IEEE 802.15.4 with MAC security, Mesh Link Establishment, Mesh Routing) and device roles, as well as Border Router support.
More information about Thread can be found at threadgroup.org. Thread is a registered trademark of the Thread Group, Inc.
Who supports OpenThread?
Getting started
All end-user documentation and guides are located at openthread.io. If you're looking to do things like...
- Learn more about OpenThread features and enhancements
- Use OpenThread in your products
- Learn how to build and configure a Thread network
- Port OpenThread to a new platform
- Build an application on top of OpenThread
- Certify a product using OpenThread
...then openthread.io is the place for you.
Note: For users in China, end-user documentation is available at openthread.google.cn.
If you're interested in contributing to OpenThread, read on.
Contributing
We would love for you to contribute to OpenThread and help make it even better than it is today! See our Contributing Guidelines for more information.
Contributors are required to abide by our Code of Conduct and Coding Conventions and Style Guide.
License
OpenThread is released under the BSD 3-Clause license. See the LICENSE file for more information.
Please only use the OpenThread name and marks when accurately referencing this software distribution. Do not use the marks in a way that suggests you are endorsed by or otherwise affiliated with Nest, Google, or The Thread Group.
Need help?
OpenThread support is available on GitHub:
- Bugs and feature requests — submit to the Issue Tracker
- Community Discussion - ask questions, share ideas, and engage with other community members